Sliver — Attack Tool

Sliver is an open source, cross-platform, red team command and control (C2) framework written in Golang. Sliver includes its own package manager, "armory," for staging and downloading additional tools and payloads to the primary C2 framework.

Tool identity and evidence

Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.

Aliases: Sliver

Primary tool reference

Existing author guides

Lab Architecture — Operation DragonRx · 2026-05-02
Attack Playbook — Operation DragonRx · 2026-05-04

Primary documentation

Sliver project and documentation

Connected ecosystem references

Linked tags

attack_tool attack_uses

Documented actor use

Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.

APT29 · G0016 · Pinned relationship source (relationship--ed096691-23a6-4104-879d-5e96d257b3f0)
TA551 · G0127 · Pinned relationship source (relationship--919ed248-2736-4024-9f0b-001c23a85d82)
Cinnamon Tempest · G1021 · Pinned relationship source (relationship--1a0bc35b-cc76-487b-a1a7-71cbfb110f24)

Technique-specific simulations and detections

Detection links describe the associated behavior, not independently verified tool-specific signatures.

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.